CVE-2025-59452
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-06

Last updated on: 2025-11-26

Assigner: MITRE

Description
The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is derived from a device's MAC address along with an MD5 hash of non-secret information, such as a key that begins with cf50.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-06
Last Modified
2025-11-26
Generated
2026-06-16
AI Q&A
2025-10-06
EPSS Evaluated
2026-06-15
NVD
CVE-2025-59452
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
yosmart smart_hub *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-340 The product uses a scheme that generates numbers or identifiers that are more predictable than required.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves the YoSmart YoLink API using an endpoint URL that is constructed from a device's MAC address combined with an MD5 hash of non-secret information, such as a key starting with cf50. This design can potentially expose device information or allow unauthorized access due to predictable or insufficiently protected endpoint URLs.

Impact Analysis

The vulnerability can impact you by allowing an attacker to potentially identify or access devices through predictable API endpoint URLs, leading to partial confidentiality loss. However, it does not affect integrity or availability directly.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-59452. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart